Compromised Bee JavaScript client runs a remote payload during npm installation
@ethersphere/bee-js 13.3.0 runs remote JavaScript during installation. Researchers observed payloads targeting Swarm Desktop keys and installing persistent remote access on Linux. Block 13.3.0, isolate hosts that ran the hook, and rebuild from a trusted version.
- Disclosed
- Nov 9, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Developer systems and CI runners that installed @ethersphere/bee-js 13.3.0 with lifecycle scripts enabled.
- node
- In the wild
- Unknown
- The malicious release and served payload were verified. Victim installations are unknown.
What happened
Version 13.3.0 changes a version-generation script into an npm postinstall loader. Installing the package with lifecycle scripts enabled can execute server-supplied code as the install user before an application imports the dependency. The loader sends an HTTPS request and executes the response. It does not need Swarm Desktop installed to start. Swarm Desktop key collection depends on the files being present and readable.
Bitbison observed a payload reading the Swarm Desktop configuration and node key, posting them to the same domain and installing a Linux user service that runs a remote-access agent. These observations describe a payload served during research. Its server can vary the response, so missing Linux files do not rule out execution. npm’s provenance points to the project workflow, and the source commit itself contains the loader. The entry point into the release process remains unknown.
The registry still listed 13.3.0 as latest when checked. Pin the exact prior version during containment. The November 9 UTC incident date follows the registry publication and Bitbison’s timestamped report. StepSecurity labels its initial notice November 8 without a timezone. Its 3,560-download figure covers all releases in the week before 13.3.0 and gives no count of affected installations. No victim count or stolen amount has been verified.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| @ethersphere/bee-js | 13.2.0 | Prior release without this install hook. Pin exactly while awaiting maintainer guidance. |
Crime-scene timeline
Nov 9, 00:06 UTC
The project's GitHub release for v13.3.0 goes public
Nov 9, 00:09 UTC
npm publishes the affected 13.3.0 package
The manifest runs scripts/generate-version.cjs as a postinstall hook and includes npm provenance metadata.
Nov 9, 00:51 UTC
Bitbison publishes its artifact and payload analysis
The researcher documents collection of Swarm Desktop key material and a persistent Linux remote-access agent.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Ethersphere GitHub release v13.3.0PrimaryThe release API records the GitHub publication at 00:06 UTC.
- npm registry package and version historyPrimaryRecords publication time, the affected install hook and provenance metadata. The 13.2.0 manifest lacks that hook.
- Ethersphere source commitPrimaryShows the manifest change and loader executing the HTTPS response with the install user's privileges.
- Bitbison artifact analysisPrimaryDocuments the observed Swarm key collection, Linux binaries and persistence indicators.
- StepSecurity initial investigationPrimaryConfirms the install-time loader and wallet targeting. Weekly download data covers all versions.